diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3bf2e54..772d8f5 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -7,6 +7,13 @@ on:
       - "v*"
   pull_request:
     branches: [ main ]
+  workflow_dispatch:
+    inputs:
+      build_windows:
+        description: 'Run full Windows image build'
+        required: false
+        type: boolean
+        default: false
 
 env:
   IMAGE_NAME: rust-llvm
@@ -65,15 +72,33 @@ jobs:
           echo VERSION=$VERSION
           docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
           docker push $IMAGE_ID:$VERSION
+  validate-windows:
+    name: Validate Windows Dockerfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Lint Dockerfile
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: windows/Dockerfile
+          # DL3006: Always tag image - we use ARG for version, hadolint doesn't understand this
+          # DL3020: Use COPY instead of ADD - we use ADD for URLs which is valid
+          # DL3059: Multiple consecutive RUN - acceptable for clarity in Windows Dockerfiles
+          # SC1001: Escape sequences - Windows uses backtick, not backslash
+          ignore: DL3006,DL3020,DL3059,SC1001
+
   build-windows:
-    name: Run windows image build
-    runs-on: windows-latest
+    name: Build Windows image
+    runs-on: windows-2022
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.build_windows }}
     steps:
       - uses: actions/checkout@v3
       - name: Build image
         working-directory: windows
-        shell: bash
-        run: docker build . --tag $IMAGE_NAME
+        env:
+          DOCKER_BUILDKIT: 0
+        run: docker build . --tag ${{ env.IMAGE_NAME }}
 
   publish-devcontainer:
     if: ${{ github.ref == 'refs/heads/main' }}
diff --git a/linux/Dockerfile b/linux/Dockerfile
index 8d212f5..29dbef5 100755
--- a/linux/Dockerfile
+++ b/linux/Dockerfile
@@ -1,4 +1,4 @@
-ARG DEBIAN_VERSION=bookworm
+ARG DEBIAN_VERSION=trixie
 ARG BASE_IMAGE=debian:$DEBIAN_VERSION
 
 FROM $BASE_IMAGE
@@ -8,20 +8,19 @@ USER root
 ENV DEBIAN_FRONTEND=noninteractive
 
 ARG LLVM_VERSION=21
-ARG RUST_VERSION=1.90
+ARG RUST_VERSION=1.93.1
 
 # Install LLVM and its dependencies
-RUN apt update \
-    && apt upgrade -y \
-    && apt install -y --no-install-recommends wget curl gnupg build-essential lsb-release software-properties-common \
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends wget curl gnupg build-essential lsb-release ca-certificates \
     && wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh $LLVM_VERSION \
-    && apt install -y --no-install-recommends clang lld liblld-$LLVM_VERSION-dev libpolly-$LLVM_VERSION-dev
-
-# TODO: Remove this once we completely switched over to LLVM 21
-RUN apt install -y zip clang lldb lld clangd clang-14 lldb-14 lld-14 clangd-14 liblld-14-dev llvm-14-dev libpolly-14-dev
+    && apt-get install -y --no-install-recommends clang lld liblld-$LLVM_VERSION-dev libpolly-$LLVM_VERSION-dev
 
 # Install llvm-lit, used by our correctness tests
 COPY --from=ghcr.io/astral-sh/uv:0.9.17 /uv /uvx /bin/
+# Use a non root directory for uv
+ENV UV_TOOL_DIR="/usr/local/uv"
 ENV UV_TOOL_BIN_DIR="/usr/local/bin/"
 RUN uv tool install lit
 
@@ -35,8 +34,10 @@ ENV PATH="${CARGO_HOME}/bin:${PATH}"
 RUN rustup toolchain install $RUST_VERSION \
     && rustup default $RUST_VERSION \
     && rustup component add clippy rustfmt llvm-tools-preview \
+    && rustup target add x86_64-unknown-linux-gnu \
     && rustup target add aarch64-unknown-linux-gnu \
-    && rustup target add x86_64-unknown-linux-musl
+    && rustup target add x86_64-unknown-linux-musl \
+    && rustup target add aarch64-unknown-linux-musl
 
 RUN chmod -R a+rw $CARGO_HOME \
     && chmod -R a+rw $RUSTUP_HOME \
diff --git a/windows/Dockerfile b/windows/Dockerfile
index eadef08..2187314 100644
--- a/windows/Dockerfile
+++ b/windows/Dockerfile
@@ -1,57 +1,71 @@
+# escape=`
 ARG WINDOWS_VERSION=ltsc2022
 ARG BASE_IMAGE=mcr.microsoft.com/windows/servercore:$WINDOWS_VERSION
 
 FROM $BASE_IMAGE
 
 ARG LLVM_VER=21.1.7
-ARG RUST_VER=1.90
-ARG ZIP_VERSION=2501
-ARG GIT_VERSION=2.51.0
+ARG RUST_VER=1.93.1
+ARG ZIP_VERSION=2600
+ARG GIT_VERSION=2.53.0
 
 WORKDIR C:/buildtools
 
-# Install VC++
-# Download channel for fixed install.
+# ==============================================================================
+# STAGE 1: Install VS Build Tools (fail fast if VS installer is broken)
+# ==============================================================================
 ARG CHANNEL_URL=https://aka.ms/vs/17/release/channel
 ADD ${CHANNEL_URL} C:/TEMP/VisualStudio.chman
 
-# Download and install Build Tools for Visual Studio 2022 for native desktop workload.
 ADD https://aka.ms/vs/17/release/vs_buildtools.exe C:/TEMP/vs_buildtools.exe
-RUN C:/TEMP/vs_buildtools.exe --quiet --wait --norestart --nocache \
-    --channelUri C:/TEMP/VisualStudio.chman \
-    --installChannelUri C:/TEMP/VisualStudio.chman \
-    --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended \
-    --installPath C:/buildtools
+RUN C:/TEMP/vs_buildtools.exe --quiet --wait --norestart --nocache `
+    --channelUri C:/TEMP/VisualStudio.chman `
+    --installChannelUri C:/TEMP/VisualStudio.chman `
+    --installPath C:/buildtools `
+    --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended `
+    && del /q C:\TEMP\vs_buildtools.exe C:\TEMP\VisualStudio.chman
 
-ADD https://www.7-zip.org/a/7z${ZIP_VERSION}-x64.exe 7zsetup.exe
-#Install 7zip
-RUN 7zsetup.exe /S /D=C:/buildtools/7z
+# ==============================================================================
+# STAGE 2: Install Rust and compile tools (fail fast if MSVC toolchain broken)
+# This validates that VS + Windows SDK are correctly installed and can compile
+# ==============================================================================
+SHELL ["C:\\buildtools\\Common7\\Tools\\VsDevCmd.bat", "&&", "cmd", "/S", "/C"]
 
-RUN setx /M PATH "%PATH%;C:\\buildtools\\7z;C:\\buildtools\\llvm\\bin"
+ADD https://win.rustup.rs C:/TEMP/rustup-init.exe
+RUN C:/TEMP/rustup-init.exe --default-toolchain %RUST_VER% -y `
+    && del /q C:\TEMP\rustup-init.exe
 
-ADD https://github.com/git-for-windows/git/releases/download/v${GIT_VERSION}.windows.1/PortableGit-${GIT_VERSION}-64-bit.7z.exe C:/TEMP/git-install.exe
-# Install git to use bash
-RUN 7z.exe x C:/TEMP/git-install.exe -ogit
+# Set PATH for Rust - VsDevCmd.bat already sets up MSVC paths
+RUN setx /M PATH "%PATH%;%USERPROFILE%\.cargo\bin"
 
-ADD https://github.com/ghaith/llvm-package-windows/releases/download/v${LLVM_VER}/LLVM-${LLVM_VER}-win64.7z C:/TEMP/llvm.7z
-# Setup llvm sources
-RUN 7z x C:/TEMP/llvm.7z -ollvm 
+# Compile cargo tools - this will fail fast if MSVC/SDK is broken
+RUN cargo install --locked cargo-nextest grcov mdbook
 
-ADD https://win.rustup.rs C:/TEMP/rustup-init.exe
-# Install Rust
-# RUN scoop install rustup
-ADD https://win.rustup.rs C:/TEMP/rustup-init.exe
-RUN C:/TEMP/rustup-init.exe --default-toolchain %RUST_VER% -y
-RUN rustup install stable
+RUN rustup component add llvm-tools-preview
+
+# ==============================================================================
+# STAGE 3: Install additional tools (7zip, git, LLVM)
+# These are slower downloads/extractions but don't affect build validation
+# ==============================================================================
+ADD https://www.7-zip.org/a/7z${ZIP_VERSION}-x64.exe C:/TEMP/7zsetup.exe
+RUN C:/TEMP/7zsetup.exe /S /D=C:\buildtools\7z `
+    && del /q C:\TEMP\7zsetup.exe
 
-RUN rustup component add llvm-tools-preview 
-RUN cargo install mdbook grcov cargo-nextest
+RUN setx /M PATH "%PATH%;C:\buildtools\7z;C:\buildtools\llvm\bin;C:\buildtools\git\bin"
 
-#RUN cargo install cargo-watch #Activate this for local builds to enable watching
+ADD https://github.com/git-for-windows/git/releases/download/v${GIT_VERSION}.windows.1/PortableGit-${GIT_VERSION}-64-bit.7z.exe C:/TEMP/git-install.exe
+RUN C:\buildtools\7z\7z.exe x C:/TEMP/git-install.exe -ogit `
+    && del /q C:\TEMP\git-install.exe
+
+ADD https://github.com/ghaith/llvm-package-windows/releases/download/v${LLVM_VER}/LLVM-${LLVM_VER}-win64.7z C:/TEMP/llvm.7z
+RUN C:\buildtools\7z\7z.exe x C:/TEMP/llvm.7z -ollvm `
+    && del /q C:\TEMP\llvm.7z
+
+# ==============================================================================
+# Final setup
+# ==============================================================================
 WORKDIR C:/build
 
 SHELL ["C:\\buildtools\\Common7\\Tools\\VsDevCmd.bat", "&&", "powershell.exe", "-NoLogo", "-ExecutionPolicy", "Bypass"]
 
-#ENTRYPOINT ["cargo"]
 ENTRYPOINT ["C:\\buildtools\\Common7\\Tools\\VsDevCmd.bat", "&&", "C:\\buildtools\\git\\bin\\bash.exe", "-i", "-l"]
-